Advanced Track Do this after finishing Chapters 01-14.

Estimated Time

  • Reading: 30-40 min
  • Lab: 60-90 min
  • Quiz: 15-20 min

Prerequisites

  • Core track (Chapters 01-14) completed.
  • GitOps promotion and observability workflows available.

Source Code References

  • require-security-context.example.yaml Members

Sign in to view source code.

What You Will Produce

Three Kyverno policies running in Audit, one promoted to Enforce, and a deny -> fix -> admit cycle you can explain.

Guardrails That Stop It

  • Policy-as-Code: All admission rules are managed in Git and reconciled via Flux.
  • Fail-Closed Baseline: Critical security policies are set to Enforce by default in Production.
  • Audit-First Rollout: New policies always start in Audit mode to prevent accidental downtime.
  • Explicit Exceptions: Policy bypasses require a documented, time-bound label or annotation.

Kyverno vs. Gatekeeper

In this course, we use Kyverno as our policy engine because it is:

  • Kubernetes Native: Policies are written in YAML, not a specialized language like Rego.
  • Mutation Capable: It can automatically inject sidecars or fix small label errors.
  • Image Aware: Built-in support for verifying signatures and attestations (Chapter 16).

Rollout Strategy

  1. Develop Audit: Apply the policy in Audit mode in the develop namespace.
  2. Evidence Collection: Review PolicyReports to identify existing violations.
  3. Upstream Fix: Correct the manifests in Git to comply with the new rules.
  4. Production Enforce: Move the policy to Enforce mode once all environments are clean.

Safe Workflow (Step-by-Step)

  1. Define Policy: Create a Kyverno ClusterPolicy manifest in YAML.
  2. Local Validate: Test the policy against your manifests using the Kyverno CLI.
  3. Deploy Audit: Use Flux to deploy the policy in validationFailureAction: Audit.
  4. Monitor Reports: Use kubectl get polr to check for violations.
  5. Enforce: Change the action to Enforce and verify that non-compliant requests are blocked.

This builds on: Core track complete — admission policies turn the runtime baseline (Chapters 06-09) into rules the cluster enforces. This enables: Supply chain verification (Chapter 16) — the same Kyverno engine verifies signatures and attestations.